v0.2.10

src/routes/mod.rs

@@ -123,6 +123,7 @@ async fn add_security_headers(request: Request<Body>, next: middleware::Next) ->
     let is_html = response_content_type_is(&response, "text/html")
         || response_content_type_is(&response, "application/xhtml+xml");
     let is_css = response_content_type_is(&response, "text/css");
+    let is_pdf = response_content_type_is(&response, "application/pdf");
     let headers = response.headers_mut();
 
     headers.insert(
@@ -136,11 +137,19 @@ async fn add_security_headers(request: Request<Body>, next: middleware::Next) ->
             "cross-origin-resource-policy",
             HeaderValue::from_static("same-origin"),
         );
-        headers.insert("x-frame-options", HeaderValue::from_static("DENY"));
-        headers.insert(
-            "content-security-policy",
-            HeaderValue::from_static("frame-ancestors 'none'"),
-        );
+        if is_pdf {
+            headers.insert("x-frame-options", HeaderValue::from_static("SAMEORIGIN"));
+            headers.insert(
+                "content-security-policy",
+                HeaderValue::from_static("frame-ancestors 'self'"),
+            );
+        } else {
+            headers.insert("x-frame-options", HeaderValue::from_static("DENY"));
+            headers.insert(
+                "content-security-policy",
+                HeaderValue::from_static("frame-ancestors 'none'"),
+            );
+        }
     } else if is_html || is_css {
         headers.insert("referrer-policy", HeaderValue::from_static("no-referrer"));
     }